Limit what agents learn about private repos with enclaves